CVE-2008-2992: Adobe Reader and Acrobat Input Validation Vulnerability

Is it exploited?

Yes. CISA added it to the Known Exploited Vulnerabilities catalog on 3 Mar 2022, 4,867 days after the CVE record was published.

How likely is exploitation in the next 30 days?

99.8%

EPSS score, percentile 100 of all scored records

How severe?

7.8 High

CVSS v3.1 base score, from CISA's enrichment of the record

What should I do?

Required action (CISA), due 24 Mar 2022: Apply updates per vendor instructions.

Advisories and patches (3)

Which versions are affected?

Not stated. The CVE record gives vendor and product as “n/a” and the version as “unspecified”.

Source: CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.28, as of 28 Oct 2026; FIRST Exploit Prediction Scoring System (EPSS), v2026.06.15, as of 28 Oct 2026; CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026. About the data.

What to do

CISA due date for this action: 24 March 2022.

Advisories and patches

• 249366 (Vendor advisory)
• SUSE-SR:2008:026 (Vendor advisory)
• RHSA-2008:0974 (Vendor advisory)

Linked from CISA's catalog entry

• https://nvd.nist.gov/vuln/detail/CVE-2008-2992

Affected products and versions

The CVE record does not name affected products or versions: vendor and product are “n/a” and the version is “unspecified”.

Source: CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026. About the data.

About this vulnerability

Adobe Acrobat and Reader contain an input validation issue in a JavaScript method that could potentially lead to remote code execution.

Summary: CISA's KEV catalog, as of 28 Oct 2026.

• CISA added CVE-2008-2992 to its Known Exploited Vulnerabilities (KEV) catalog on 3 Mar 2022.
• CISA marks it as known to be used in ransomware campaigns.
• The due date CISA sets for the required action is 24 Mar 2022.
• The CVE record was published on 4 Nov 2008, 4,867 days before it was added to KEV.
• The CVE record carries a CVSS v3.1 base score of 7.8 (High), taken from CISA's enrichment of the record.
• FIRST's EPSS model puts the probability of exploitation in the next 30 days at 99.8% (percentile 100), as of 28 Oct 2026.
• CISA's SSVC assessment in the CVE record: exploitation active, automatable no, technical impact total.

Source: CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.28, as of 28 Oct 2026; CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026; FIRST Exploit Prediction Scoring System (EPSS), v2026.06.15, as of 28 Oct 2026. About the data.

Description

Stack-based buffer overflow in Adobe Acrobat and Reader 8.1.2 and earlier allows remote attackers to execute arbitrary code via a PDF file that calls the util.printf JavaScript function with a crafted format string argument, a related issue to CVE-2008-1104.

Source: CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026. About the data.

Weakness

• CWE-787: Out-of-bounds Write
• CWE-119

CWE and CAPEC are maintained by MITRE; the entries are those named in the CVE record and the KEV entry.

Timeline

References

• 32700 (Third-party advisory)
• 35163 (Third-party advisory)
• 32872 (Third-party advisory)
• 4549 (Third-party advisory)
• 29773 (Third-party advisory)
• TA08-309A (Third-party advisory)
• VU#593409 (Third-party advisory)
• 7006 (Exploit)
• 6994 (Exploit)

15 more in the CVE record.

More exploited Adobe vulnerabilities

• CVE-2026-48356: Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability (added 27 Oct 2026)
• CVE-2026-71362: Adobe Commerce and Magento Incorrect Authorization Vulnerability (added 24 Sep 2026)
• CVE-2026-75650: Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability (added 8 Sep 2026)
• CVE-2026-48282: Adobe ColdFusion Path Traversal Vulnerability (added 7 Jul 2026)
• CVE-2009-3459: Adobe Acrobat and Reader Heap-Based Buffer Overflow Vulnerability (added 20 May 2026)
• CVE-2020-9715: Adobe Acrobat Use-After-Free Vulnerability (added 13 Apr 2026)